Yenya's World

Mon, 23 May 2016

One-time USB-IP

For some ugly proprietary software, I need to access an USB device
(a hardware key) from the Windows-based virtual machine. I tried
to use USB-IP with mixed
results.

At first I created a Windows 2008r2 testing virtual machine. I tried various
versions of usbip (both kernel-side drivers and the user-space
utility), and finally using some version of drivers with the patched
usbip.exe probably from this thread
helped and I was able to see the HW token from the inside of the Windows guest,
install the proprietary software there, and make it use the token
(after disabling the token it complained about missing HW key, so I guess the
token was indeed successfully used before). I even tested the token
in my Linux workstation as well as in the server where it will be
in production use. So far OK.

Now the ugly part: I wanted to create a document describing how to
access the HW token from the Windows VM, so I created a new Windows VM.
And now I am not able to reproduce the process of installing the drivers
and accessing the token from the VM itself :-(. I must have done something
what I don't remember exactly, but now I can only list the devices on the
server using "usbip.exe -l my.ip.addr", but trying to attach
the device with "usbip.exe -a my.ip.addr bus-id" fails with
"Cannot find device" error message.

I am not sure what am I doing wrong, but I am sure that it has worked
before. I feel like an idiot. Anyway, how would you make an USB device
accessible from the inside of the Windows-based VM?

2 replies for this story:

Thanks, but this is not suitable for my application - my Windows VM will be in a private cloud, so it will not be fixed to any particular physical host. I really need some kind of usb-over-IP. Anyway, after a week or so banging my head against the wall I finally made it work. I am still not sure what was the problem, but the above linked usbip.exe and the 0.2.0.0 version of signed Windows drivers now work for me.

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Tue, 29 Mar 2016

Broadcom WiFi Versus Windows 10

Broadcom is rumored to leave the wireless chipset business. I would
like to add a single word to this rumour: "finally!".

I use a venerable Linksys WRT 54GL accesspoint for my home wireless network,
and I run OpenWRT on it, because the stock firmware itself is unmaintained
and insecure (not to mention the additional flexibility of OpenWRT).
Then only problem is that Linux/OpenWRT uses the reverse-engineered
driver for Broadcom WiFi, because the vendor-provided specification
is next to none.

After upgrading the only Windows-based laptop we have at home to Windows 10,
the WRT started crashing as soon as the laptop tried to connect to the
network. It has simply rebooted. Incidentally, the laptop itself has also
a Broadcom WiFi chip inside. I tried to use various versions of OpenWRT,
but the problem is present in all versions.

Anyway, the WRT54GL is pretty old and OpenWRT barely fits in it, so I am
looking for a replacement. I probably don't need fancy features such as
USB host or even routing (I use the PC as a router). Just a WiFi AP
and an ethernet switch. Preferably running OpenWRT. Do you have any
suggestions, my dear lazyweb?

7 replies for this story:

Turris Omnia: https://omnia.turris.cz/
Very powerful (open-source!) hardware with promise of high security and exceptional support by (Czech) manufacturer and complete freedom in software customisation. there also is a high chance of great community around the project.

Yep, Turris is probably one of the APs to consider. Do you know anything about the state of the firmware? Early Turris routers contained lots of big-brotherish antifeatures such as collecting information about the network traffic, etc. Is present-day Turris firmware usable without "calling home"? Alternatively, does OpenWRT run on the Turris Omnia hardware?

Disclaimer: I am not connected to the CZ.NIC or the Turris project. Just fun and Turris Omnia buyer.
It is important to distinguish between the original Turris and Turris Light.
The original Turris router was/is research project on network security *based* on the call home functions as these were the reason the original Turris device was developed and ‘leased for free’ to selected group of people (selected to have a representative group of different network locations, types of users etc.). This device is impossible to buy – it was given to volunteers selected from an I-am-interrested-to-participate list –, but a lot of people were interested in the device and CZ.NIC guys were speaking several times a lot of people ‘whimpered’ to be able to get their own Turris device.
That was the reason Turris Light (later renamed to Turris Omnia) project started. It is ‘light-weight’ (comparing to the original Turris device with manufacturing price ~12k CZK, not comparing to any SOHO router currently the market) version of the original device. The firmware is base on OpenWRT (see https://omnia.turris.cz/, so I do not expect any problems with using your own ‘pure’ OpenWRT installation if you are interested) but extended with CZ.NIC Python user interface and utilities. (BTW, I was told these Python extension will probably not be merged to the OpenWRT upstream as common SOHO router is not powerful enough to be able to run these programs fast enough so OpenWRT team is not interested in it.)
The call-home functions are available in Turris Omnia OS but these are *opt-in*, i.e. you have to explicitly enable them. These are not mandatory as you are getting your device for money, not for participation in the research where the network data is the ‘fee’ to the manufacturer.
CZ.NIC promised to publish full hardware data sheets, interconnection schemas etc. but only after starting of the production. At DevConf 2016 CZ.NIC guy told they have signals that some Chines manufactures would like to start production of their own Turris Omnia copies even before CZ.NIC. ;-)
The Turris Omnia is not cheap (comparing to a common SOHO router) and not immediately available (the current availability estimate is May or even June 2016) but the hardware is powerful enough it could possible fully replace your routing PC by a small box with low power consumption and no noise as there is no active cooling.

OK, thanks for clarification. Yes, Turris Omnia specs are pretty impressive. As I said, I am considering this. But no, there is no way it can replace my home PC as an always-on device - I need remote access to terabytes of my data (photo archives, remote backups, etc.), so using a small embedded box would mean to have separate boxes for HDDs with their own power, cooling, etc., AND having to power up my desktop PC whenever we want to use it. So strictly speaking, I really only need a sufficiently open WiFi AP with ab integrated ethernet switch. There are also other reasons against Turris - for example, AFAIK it cannot be bought, it can only by "supported" on indiegogo, so it would probably be difficult to get an invoice in Czech, etc.

I understand the reasons why Turris cold be ‘overkill’ and simultaneously insufficient to replace the PC doing more then routing but the invoice should not be a problem – if you support the project and select the router as the perk you will be requested to register at https://omnia.turris.cz/ (account pairing with indiegogo order on email address) where you can select color and power cord type and where you get the invoice after finishing the order. In the end, it is CZ.NIC project so cold be probably doable more in case of any ‘Czech specifics’. ;-)

Reply to this story:

Wed, 04 Nov 2015

Fedora 23

The upgrade to F23 was flawless both on my workstation and on my laptop.
So far the changes I noticed were:

GDM tries to run Xwayland instead of Xorg (yes, I still run GDM on one of my computers out of curiosity). It can be disabled with adding the following
to your /etc/gdm/custom.conf:

[daemon]
WaylandEnable=false

On my workstation, the mouse cursor was displayed about 20 pixels right and 20 pixels down from the place it in fact pointed to. For example, I was not able to reach the top left corner at all. The quick fix was to remove the old /etc/X11/xorg.conf file I have been using for ages, and let everything
to be autoconfigured. This could be a problem on my dual-seat home computer,
where I need to use Xorg.conf in order to have the seats
configured properly.

Firefox has broken the NewTabURL add-on, in their yet another
futile attempt at guessing what I want to see in a new tab. This can be solved
by installing a NewTabHomepage add-on instead.

On my laptop, which has 14" FullHD screen (about 157 DPI), Firefox started
to use the DPI value from the desktop environment, so I can finally move back to 12pt fonts instead of 22pt, which I had to set up manually only for Firefox. On the other hand, it started scaling images, so many icons and other images (including the icons in Firefox own menus) are a bit blurry now.

To sum it up, pretty flawless upgrade. I will obviously wait for some time before upgrading my home dual-seat desktop, as I always do.

0 replies for this story:

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Tue, 15 Sep 2015

Eternal Spring

This year we spent our holidays in the
island of eternal spring.
I have been to Madeira in 2010 at
a conference,
and I had only about two and
half days to visit something outside the hotel. This time, we decided
to spend two weeks there: one week in Funchal, and another one somewhere
close to the Northern coast.

We tried to ask travel agencies whether two-weeks trip with them is possible,
but the reply was that it would be difficult. So we ended up booking the
flight and accomodation for both weeks separately. Surprisingly enough,
the price was about the same as with the travel agency.

We enjoyed the sea, gardens in Funchal, mountains, and of course levada walks.
The weather was nice: it was about 19 °C and foggy weather in the mountains,
while the temperature attacked unbearable values of 35 °C in Brno.
I can highly recommend Madeira, I would say there
is still at least another week worth of interesting places for us to see
there.

Speaking of photo galleries: I used Photoswipe
for the above gallery. It turned out to be customizable enough for my needs. The only drawback is
that it does not work well in Fennec (a mobile version of Firefox on Android).

0 replies for this story:

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Mon, 14 Sep 2015

Service Bloat

I have (finally) upgraded my home workstation/server/router to Fedora 22.
Newer Fedora releases have an anti-feature called "product": one cannot
simply install "Fedora", the "Fedora Product", such as Fedora Workstation,
should be selected first. For a system with X session (two X sessions,
in my case), "Fedora Workstation" seems to be a natural choice.
It is not: "Fedora Workstation" can be translated from Fedora Newspeak
to an ordinary English as "Fedora GNOME 3". So this is a no-go.

A time ago, I came across a suggestion that "Fedora Server" is probably
the closest thing to former "Fedora". So I upgraded my home box to
"Fedora Server". Today, after a routine inspection of open ports on my
home server, I discovered that something is listening on port 9090
on INADDR_ANY (and IN6ADDR_ANY as well). One fuser -n tcp,
and I discovered that the listening process is called cockpit-ws.

Digging further into it, it seems that this is a web-based administrative
interface (do you remember linuxconf, anyone?), probably another futile
attempt to encapsulate the strength of all the configuration files to some
useless web-based interface. Moreover, it cannot be uninstalled, as it
depends on the fedora-release-server package.
A side note: the cockpit-ws package contains font files,
which is probably against Fedora Font Packaging Guidelines.

I wonder what happened to the "no unnecessary services should be enabled
by default" philosophy. It seems that Cockpit is a blatant example
of an unnecessary service, which is not only installed by default, but
also enabled by default in Fedora Server 22.
I recommend to run the following commands:

# systemctl stop cockpit.socket
# systemctl disable cockpit.socket

What other kinds of service-bloat did you find on your computers?
Watch for newly opened ports after Fedora upgrades.

Nice. I've installed all but four. fedora-minimal-conflicts-gnome conflicts with libxklavier but that is needed by lightdm, xfce4-settings, and xfce4-xkb-plugin -- all things I kinda like. And fedora-minimal-conflicts-anaconda wants to remove pykickstart which I have no problem with except it would take away dnf-plugins-core which sounds a bit hardcore.

Yenya, Yes. My understanding is that removing fedora-release-server is what you need.
Adelton, I'll happily accept patches. pykickstart has been only recently required by dnf-plugins-core. libxklavier is not useful for me, but we could move it out of fedora-minimal-gnome pkg to some other.

Uninstalling fedora-release* will break dependencies probably. Proper way is to have installed exactly on of the fedora-release* packages (e.g. "dnf --allowerasing install fedora-release). See
[http://koji.fedoraproject.org/koji/buildinfo?buildID=637888]. By the way product introduction has already happened in Fedora 21. I recommend reading [https://fedoraproject.org/wiki/Upgrading_Fedora_using_yum#Version_specific_notes].

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Mon, 31 Aug 2015

Mission Completed

The project I started
long, long
time ago and which made
a slow,
but steady progress
since then, has been finished
today. Also, this month is a 10 years anniversary of this blog, which I have
started in August 2005.

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Tue, 14 Jul 2015

Which Web Gallery?

I am looking for the best way how to publish my photos on the Web.
So far I have ruled out putting my photos to some "cloud" service
out of my control (Picasa, Flickr, Rajče). I want something which
could generate a static tree of files (HTML/CSS/JPG/JS), which can
then be published by any web hosting service, or even on my own server.

Some time ago I have tested Highslide.js,
but this is more lightbox than a gallery, and it cannot adapt itself to
the size of the screen.

I have looked at Darktable, which
has its own "web gallery" export format, but surrounding Javascripts
are not good enough to make it fit the screen.
I have googled many other project, usually ruling them out solely based
on their demo galleries.

What looks promising so far, is the thing named Photoswipe. There still are some problems, though:

When the image has much wider aspect ratio than the screen, the image
caption is displayed far away from the image itself.

It is configured in Javascript, instead of just adding images and their
thumbnails to the HTML file with the appropriate classes.

The thumbnail view somewhat sucks (see the thumbnail lists near the
bottom of their own getting started page.

So, my dear lazyweb: which gallery for static files do you use? I would like
to have something with the following properties:

5 replies for this story:

I know, that it is maybe something different, then you are searching, but I'm using trovebox. You can see it live at fotky.stodulkovi.cz. It supports private and public stuff, sharing by creating link, albums, tags (!) and is quite fast. What is bad is, that trovebox is discontinued, but it is still by far the best private-hosted gallery I have seen, and I have searched a lot. (I had to do also some tweaks to have it working the way I want to.)

Hm, you are right with cookies, I have never tried this. :-) There is session ID cookie. IMHO there is nothing wrong on cookies, as long as they are used by the server, which originally issued them. BTW - Picasa works without cookies?

Picasa without cookies? No idea, I don't use Picasa. And for things like Google Excel (or whatever, people occasionally send me links to that crap and want me to write something in there) I tend to have a special Firefox session which has cookies for TheBigBrother.com allowed.

Reply to this story:

Mon, 13 Jul 2015

Systemd Developer Attitude

Systemd. Some people love it, some people hate it. My own position
is somewhere in between: I think many things they are trying to solve
are real problems which need solutions, the system should "just work"
for common use without the configuration, etc. But sometimes the overall
attitude of the systemd developers is just plain wrong.
The following bug report shows the problem pretty clearly:

The systemd maintainer's response was "we are not a vendor,
we don't want a vendor pool", and "let's add a warning when somebody
uses the defaults". I think using Google servers against the will of their
owner is pretty rude, and having the defaults which need to be replaced,
even though the possibility of having sane defaults exists,
to be inconsiderate to their users.

In my opinion, the above clearly shows the attitude of systemd developers
towards the rest of the world.

0 replies for this story:

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Fri, 10 Jul 2015

My First CVE Number

After banging our collective heads against the wall while trying to discover
why one Samba share works as we expect, while another one with the same
configuration on the same server does not, I have finally admitted that
the bug is not in our setup, but probably in Samba itself.

Interestingly enough, the expected behaviour was the share where it did
not work, and the other one worked only by accident. The fact that it
worked in one case turned out to be a potential minor security issue.
So this is the first security issue I have discovered, which has its
own CVE number: CVE-2015-3287 (details will be in
Samba bug #11395
after it is declassifiled).

I appreciate the fast response of Samba developer Jeremy Allison: the first fix
was available within 3.5 hours after the bug was reported.

OK, X1 definitely does not look like a Thinkpad, which is positive. However, it looks too light and too brittle for me, does not have a VGA connector, has touchpad without buttons (the buttons above are definitely not usable for working with the touchpad itself), and comes with Microsoft tax. If I read the prices correctly, an X1 with i7-5500U costs at least thre times more than the HP Probook 450 G2 with the same CPU.

From the list of possible machines I would go for EliteBook 850 (or better for EB 840, i.e. 14" model, as that screen size seems to me to have the best usability/mobility ratio).
I have EliteBook 840 G1 (http://www.notebookcheck.net/Review-HP-EliteBook-840-G1-H5G28ET-Ultrabook.114717.0.html) and I like the machine very much except for its display and keyboard. :-) The FullHD screen on your machine should be perfectly OK (matte IPS display; beware of models with lower resolutions as these are TN displays with terribly low contrast [I have one with 1600×900 in my EB 840 G1]). However, the keyboard sucks and I am afraid your model will do no better. I use my notebook just occasionally so more practice could do better but any move from my desktops' mechanical keyboards to the EB 840 keyboard is always really painful. After six months I am still unable to write my passwords correctly in two out of three attempts.
Everything else seems to be OK. The chassis has its solid feel (and incredibly easy maintenance: http://youtu.be/j6Dujq2fHrc?t=1m59s) but the computer is very light with just a tiny charging adapter. You can install M.2 SSD (only 42 mm variant fits) which I really like – I use M.2 SSD for system and files in use and the original large rotating HDD (usually sleeping) to have encrypted backup of all my files always with me. Non-original (i.e. much cheaper) RAM modules are also usable with no problem. [I made a really bad experience with Lenovo laptops – non-original DVD-Drive to 2,5" HDD adapter (for secondary SSD) did not work at all (confirmed on two models of Lenovo notebooks with two different HDD adapters). However, Lenovo keyboards are far better. (Even though not as good as used to be in IBM era.)]
Battery life is very good (recent Intel CPUs have amazingly low power consumption in idle states so turned of notebook lives very long [~5–6 hours] on battery if used for lightweight work such as browsing internet or working over SSH). It is possible to buy (inelegantly expensive) secondary battery to effectively double the battery life. There is also a docking connector. I _really_ like docking my notebook for use of better keyboard and monitor and charging and networking with no need for clowning around with cables.

You are right. Today I have discovered that it would probably be possible to buy an EliteBook 840 G2 without the Microsoft tax, even though it is not offered as such in Czech e-shops. So yes, an EliteBook 840 G2 with FullHD screen is currently my favourite. I have a slightly different use case - I don't use it as my primary workstation neither at work nor at home, so I don't need docking or an external keyboard at all.

Maybe you should also consider the preinstalled backdoors (especially BIOS) and whether they are going to be replacable by something like coreboot. That would probably limit your options more than any of the other requirements though.

We bought few HP EliteBooks 840 G2 recently and they're fine so far. Just few cons, which may not be important for your use case :-)
We had EliteBooks 8540w earlier and the chasis was more solid. The new chasis is more like plastic from my point of view (although it's magnesium/aluminium) and i don't trust it would survive what those old did.
Second is just a cosmetic, but could be really painfull in a long term... If you'd have a look, there's a divide between front edge of chasis and the area with keyboard:
http://www.hpmarket.cz/library/configuration/notebooky/HP-EliteBook-840_v3b.jpg
If you don't use keyboard and lay your wrists on that edge when typing, it could be really disturbing and even painfull (esp. after few hours).
Arrows on the keyboard layout are terrible!
And we bought it from Autocont, they were able to order it from HP precisely how we wanted it - part after part, without OS. Price might have been bit higher than from eshops, but it was still better for us. I could provide you with direct contact.
Btw. there's HP Ultraslim Docking Station available for this model.

Yes, I am aware of this. However, I am afraid that it would be an outer design thing only, and as I wrote above, I am not a big fan of the classical thinkpad look. We will see after the specs of the internal parts are announced.

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Fri, 29 May 2015

Historic Bugs

After each Fedora release, the bugs reported to the release which
is to be EOL'd, are being closed. I have looked at the notifications
sent out after the Fedora 22 release, and most of my bugs-to-be-closed
are waiting for the developers to do something about the bug.
I wonder whether reporting bugs to Fedora bugzilla is still worth
the effort. Anyway, the following reply to the bug closing notice made my day:

No! This bug is on the federal register of historic bugs! You can't close it now. Changing to fedora 22 (where, of course, it is still busted).

As you might guess this is in reply to the infamous
"no way to control X server startup options" bug #451562 of GNOME Display Manager.
There is nothing being done about the bug (reported in 2008 against Fedora 9),
despite
promises
from 2009, that the bug is being worked on. Apparently GNOME developers are
busy making their applications
incompatible
with other desktop environments instead.

0 replies for this story:

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Thu, 28 May 2015

GNOME-Only Applications

Once upon a time, there was a windowing system called X. There were lots
of applications for X written using various widget toolkits. In order to make
the window operations unified across the whole desktop, regardless of the
widget toolkit used by a particular application, the special application,
called "window manager" provided window title bars and borders.
Applications could inform the window manager about their particular needs
(for example, their minimum required window size, etc.) using an open
protocol called ICCCM. Not anymore.

Nowadays, GNOME developers decided that the only way to use their system
and their applications is to have the complete desktop including all running
apps GNOME-based. Being able to run GNOME apps under other desktop environments
and vice versa is sooo last century way of desktop computing. From now on,
all GNOME applications inform the window manager using ICCCM, that their
windows are not to be touched by the WM. These windows then do not have
window borders for resizing, raising/lowering/etc., they have their own
title bar and maximize/minimize/close buttons different to the rest of the
desktop, etc.

OK, after ditching GNOME desktop environment when GNOME 3.0 came out, it is
time to ditch also the GNOME applications, as they are clearly not intended
to run under the standard desktop environment. So far I have replaced
the following applications:

6 replies for this story:

I use geeqie and zathura. Sometimes okular, whenever I need annotations or just wish to have something to click on. As a GUI file manager I use krusader, primarily because it's the only thing that is able to connect to my Android phone via MTP.

For images definitely gqview (GTK based) - the only bad thing is it cannot play animated gifs :-(.
For PDFs - I am still looking for the good app for me, now I use qpdfview.

Reply to this story:

Name:

URL/Email:

[http://... or mailto:you@wherever] (optional)

Title:

(optional)

Comments:

Key image:

(valid for an hour only)

Key value:

(to verify you are not a bot)

Mon, 23 Mar 2015

Backward Compatibility

One of the alleged advantages of certain family of operating systems
from Redmond is backward compatibility. They say they support interfaces
and applications back to the DOS era, and they sometimes even use this
feature as an excuse for some doubtful technical choices they made.
Yesterday I have discovered that it is not as good as they often say.

I wanted to install The
Neverhood, an old 1996 adventure game.
The result was the perfectly working game under
WINE and Linux, and partly-working game under Windows 8.1: the gameplay was
OK, but the in-game video sequences and their sound were too sluggish,
as if it required 5 to 10 times more powerful hardware.
According to the discussion forum posts
about this topic,
it is a common problem in newer versions of Windows.
The recommended solution is to run the game under
ScummVM, which is a rewrite of
many ancient game engines.

Remember this the next time you hear an exaggerated statement about the
backward compatibility of Windows.

0 replies for this story:

Reply to this story:

Thu, 19 Mar 2015

Libvirt Dependencies

Welcome to Yenya's rant about software "features".
Today we will have look at libvirt
in Fedora and its dependencies. But firstly let me show you a funny picture:

Anyway. I teach a seminar on Linux administration,
where one of the tasks is to compile and use one's own kernel. The task for
the following week is to create a virtual machine. One of my students had
an interesting problem with the second task - virsh refused to start
his KVM-based virtual machine with the "command timeout" message.

Digging into the issue, we discovered that it works with the distribution
kernel, but not with his custom kernel. Then we found that virsh
tries to do a RPC call over D-Bus, which then times out, because the
D-Bus object in question was not present. This object is supposed to be
provided by a daemon called
systemd-machined, which describes itself with the following headline:

This is a tiny daemon that tracks locally running Virtual Machines and Containers in various ways.

This is in fact an understatement, with the real situation being that this
daemon is a core part of the virtualization subsystem, and it is not even
possible to start a libvirt-managed guest without it. We have tried to start
the daemon from the command line, but it immediately exited without a meaningful
message anywhere. The only message in the syslogjournal was
that systemd-machined failed to start when the system was booted.

Long story short, my lucky guess was that systemd-machined could have
something to do also with containers, and it might have needed a container
support in the kernel. After enabling about five namespaces-related kernel
config options and booting a recompiled kernel, we were able to start
systemd-machined, and only then we managed to start the VM
using virsh.

This spaghetti-structured unstraceable mess of interconnected daemons
communicating over D-Bus and providing no meaningful error messages,
which is masqueraded under a collective name "systemd", makes me sick
quite often.

5 replies for this story:

If libvirt fails hard when it fails to communicate with systemd-machined and at the same time it reports no useful error message, I'd consider that a bug in libvirt.
You did not write what the error about starting systemd-machined said. Was it something like "Failed at step NAMESPACE spawning systemd-machined"? In systemd-machined.service you'll find it declares several security features whose implementation relies on namespaces:
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=full
ProtectHome=yes
If the kernel does not provide them, the service cannot start.
There are many ways to shoot oneself in the foot when configuring a custom kernel. After spending quite a lot of time debugging some issues reported in Red Hat Bugzilla where the reporters failed to disclose they were using custom kernels (and on one occastion, when the fact became apparent, the reporter even refused to do a test under a Fedora kernel), I have developed a dislike for custom kernels. If you got to have one, please at least use the distro's config as the starting point and only trim down what you KNOW you don't need ("make localmodconfig" is nice).

My rant is about something other. I do not deny that systemd-machined requires special kernel features. What I find "interesting" is that virsh fails to start a KVM-based virtual machine in a situation when systemd-machined is not running. There is no need for virsh to require systemd-machined. As systemd-machined describes itself, it only tracks the VMs, it should not be a hard requirement for them. Moreover, when I do not use containers, my KVM-based VMs should not fail only because I don't have container-related features in my kernel. Also, the exact "solution" you describe is the reason of why even I don't compile my own kernels anymore - with custom kernel, random pieces of the distribution start failing, even though the features they are missing are not strictly needed for my use cases. This is the reason of recent decline in the number of "voluntary" kernel developers: using custom kernels has become increasingly harder and troublesome.

I don't know about the goals of libvirt developers, so I cannot say whether the hard requirement on machined is justified or not. As I wrote earlier, at the very least it should report a useful error message. But maybe you're right and it should just continue regardless of the error. Still I don't see this in any way as systemd-machined's fault.
I disagree with your point "I'm not knowingly using containers => I should not need container-related features in the kernel". Namespaces have a wider use than just for what people think of as containers. In my view it is perfectly acceptable if programs want to use these features for security hardening or whatever. They don't necessarily have to appear to the user as running in containers.
Using localmodconfig it's fairly easy to create a custom kernel that's both quite lean and not lacking essential features. So I disagree with your conclusion.

There are several problems: firstly, I would guess the dependency on systemd-machined has probably been added to libvirt by systemd developers. Even after reading the manpage, I fail to see the benefits systemd-machined brings to the libvirt user. There are probably none. Secondly, I am fully aware of benefits of namespaces besides their use for creating containers (having per-user /tmp is one of the most clever tricks, for example). So the implication you are trying to put into my mouth is in fact different: I would say something like "I don't use containers and I don't depend on namespaces for my applications => the applications should not fail just because the namespaces support is not present in the kernel". It is the same way as (at least for now), the system is still working even when booted with selinux=disabled.

Looking at libvirt.git, support for systemd-machined was added to libvirt by Daniel P. Berrange, who's not a systemd developer. Though no doubt he communicated with Lennart first. From some of the commit messages, it seems to me the intention was not to have a hard dependency. It may be that the observed hard dependency is simply a bug. This leads me to your corrected implication. Having applications always degrade gracefully when faced with missing kernel features sounds like a nice plan, but may be difficult to achieve in practice. I mean QA most likely only test on the standard kernel. Adding the requirement of testing various kernel configurations would quickly lead to exponential explosion.